A funny thing happened yesterday…as I was checking my mail, I noticed an envelope from the IRS. I was starting to freaking out, and I kept thinking to myself, “I paid everything I owed, so what is the problem?” Well, it turns out that there really is no problem after all. Instead, my wife and I received a refund check in the amount of $2,144.00. My first thought was “Hey, I have money now to expand my tech writing business!!”
But then I also realized, that this could also be an error on part of the IRS. I have heard of stories where after you cash a check, they want the money back (of course), but they also charge interest on top of that!! So I called my tax attorney, left a message, and an e-mail asking what to do. After some more research, I discovered that there is an actual scam going on about refund checks.
Apparently, phony checks are going out, and the scammers leave a threatening phone call saying that you have to a call back a certain number. After I thought about it, I realized I got a few of these weird calls last week, so I am just waiting to hear back from my accountant. More than likely, the check will have to be returned ☹
More information about this scam can be seen at this link:
Anyways, this brings up another issue as to the safety and security of our financial system. I came across an article this morning, as to how hackers actually can hack into our banking system. It states that although we have put up great walls of defense in terms of technological advancements, the banks still fall short, and the Cyber attacker can still get through. How is this still possible?
Just consider some of these alarming statistics, according to a security testing firm called “Positive Technologies”:
*Penetration testers succeeded in obtaining access to banking applications in 58 % of cases;
*At 25 % of banks, workstations used for ATM management were compromised;
*At 17 % of banks, card processing systems were poorly defended;
*22 % of banks had their internal networks hacked into in the last three years.
So, what is at the root cause of all of this, if our financial system is deemed to be so secure? Here are some reasons:
*Banks are at risk due to remote access;
*The most common types of network protocols are that of the SSH and Telnet, which are used on the network perimeter at over 50% of the banks in the US. Also, these same protocols are used for file server access, which is used at 42% of US banks.
Overall, despite these technological weaknesses, it seems like that it is social engineering, especially Phishing schemes, which is the most used tactic by the Cyber attacker. Consider some of these numbers:
*Employees at 75 % of banks clicked on links in phishing messages;
*At 25 % of banks, employees entered their credentials onto a fake authentication form;
*At 25 % of banks, at least one employee downloaded a malicious attachment on their work computer.
Apparently, one of the biggest ways that a Cyber attacker can gain access to inside a banking system is through an inside job. For example, a rogue employee can hook up with a Cyber attack group on the Dark Web, and the Cyber attacker can also manipulate third party vendors (such as contractors) to give out network access information via very stealthy Social Engineering techniques.
Once the Cyber attacker is in, then it is just a matter of gaining access to the critical assets of the IT Infrastructure. This is very often done by conducing a dictionary style attack on the password database(s) at the bank. For example:
*Weak passwords are set by employees on roughly 50% of the computing systems;
*25% of banks still uses these as passwords: P@ssw0rd; admin; Qwerty123″, blank passwords, and default passwords such as “sa” and “postgres”.
The moral of this blog is that just relying on technology is not the only answer when it comes to addressing security issues. A lot of has to do with the human factor as well, and when you put the two together, then one can say you have a great security model put into place.
I have to be honest, when I was a contractor at Northern Trust Bank, even I fell victim to a Phishing scheme. But luckily, this was done through the HR department, and it was just a training exercise. It all comes down to the fact that we all need continual security training, as well as reminders, whether it is via company based memos, E-Mails, etc.
As far as the Insider Attacks, I have written extensively about this before, and unfortunately, there is very little that can be done in this regard. The owners of businesses and their employees have to all have a vigilant eye on what is happening in their surroundings, and report any suspicious activity on a secure lines of communications to their manager.
This is not at all hard to accomplish, it will just take a lot of hard work on the human side, and one day, we will get there.